This vulnerability in SeedProd's Coming Soon Page, Under Construction & Maintenance Mode plugin allows an authenticated user with high privileges to perform Server-Side Request Forgery (SSRF). The affected versions include all versions up to and including 6.19.8. The SSRF flaw could enable attackers to make the server send crafted requests to internal or external systems, potentially exposing sensitive information or modifying data. The CVSS vector indicates network attack vector, low attack complexity, required privileges at high level, no user interaction, and partial confidentiality and integrity impact without availability impact.

Exploitation of this SSRF vulnerability could lead to partial disclosure of sensitive information and unauthorized modification of data within the context of the affected plugin. The impact is limited to confidentiality and integrity, with no availability impact. The attacker must have high privileges on the system to exploit this vulnerability, which reduces the risk to some extent. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege user access to the plugin and monitor for unusual request patterns that may indicate SSRF attempts. Avoid exposing the plugin's functionality to untrusted users. Follow updates from SeedProd for an official patch or mitigation instructions.